# com.twmarketdata/tw-market-data

Taiwan stock market data (TWMD): official-source, point-in-time-safe datasets via read-only tools.

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the content rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 1.28.1
- **Author:** com.twmarketdata
- **License:** Unknown
- **Endpoints:** streamable-http https://mcp.twmarketdata.com/mcp
- **Source:** https://twmarketdata.com
- **Endpoint health:** reachable (last checked 2026-09-16T12:04:39.030Z, 4 samples) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the content rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: clean
- Obfuscation scan: clean
- Evidence age: 1 day

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-16T12:04:39.030Z
- **Version scanned:** live
- **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it.

## Tools

41 declared. Observed from a live `tools/list` probe.
- `list_datasets` — List available Taiwan-market datasets (discovery entry point). Returns id / 中文名 / category / tier / one-line description for each. Use this first to find the ri
- `describe_dataset` — FULL semantics of one dataset: grain (what a row is), field meanings+units, ★TIME-CORRECTNESS rules (knowledge_time_field / point_in_time_safe — read before bac
- `query_dataset` — Query rows with built-in look-ahead protection. ★ POINT-IN-TIME: pass `as_of` (YYYY-MM-DD) for backtesting/agent-learning. For non-point-in-time-safe datasets (
- `find_related` — Traverse the knowledge graph for cross-table / supply-chain reasoning. - dataset_id: returns join-able datasets (+why) to plan multi-table analysis. - ticker: r
- `search_filings` — Semantic search over MOPS filings, financial-statement notes and company news. Answers questions a keyword filter cannot: "what risks did this company disclose 
- `explain_provenance` — Where did this number come from, and when could anyone have known it? (WP-6) ★ THIS IS THE GROUNDING TOOL. Every other tool's answer is supposed to be expandabl
- `get_inclusion_proof` — Prove a row was in the snapshot TWMD published — and check it yourself. Returns the Merkle sibling path, the signed root, and the checkpoint it belongs to. It r
- `cite_this` — Produce a bibliographic citation for TWMD data — APA, BibTeX, and a re-verifiable token. ★ FOR PAPERS, REGULATORY FILINGS AND ANYTHING A REVIEWER WILL RE-CHECK 
- `read_primary_text` — Read the FULL TEXT of filings and announcements — with proof links and a knowledge cutoff. ★ NOT `search_filings`. That one ranks passages by similarity and han
- `ask` — Answer a plain-language question in Taiwanese-market vocabulary, sentence by sourced sentence. ★ FOR BEGINNERS WHO DO NOT KNOW WHICH DATASET THEY WANT. Ask "PBR
- `chart` — Turn rows you already fetched into a Vega-Lite drawing your chat window can render. ★ IT DRAWS; IT DOES NOT FETCH. Hand it the output of `query_dataset` — this 
- `screen` — Turn a spoken shortlist description into explicit numeric cut-offs, and show the cut-offs. ★ THE THRESHOLDS COME BACK WITH THE SHORTLIST. "低本益比" becomes `per < 
- `query_regime` — The Taiwan business-cycle light (NDC monitoring indicator) as a monthly series. ★ THIS IS A REVISED FIGURE, NOT A POINT-IN-TIME ONE. Every response carries `rev
- `calendar` — Sort corporate dates into what is still ahead and what has already passed. ★ TWO DATES, NOT ONE. What is "upcoming" is decided by the date the event HAPPENS; `a
- `compare` — Lay two to five named companies side by side on the same measures, gaps marked as gaps. ★ AN ABSENT FIGURE STAYS ABSENT, AND THE COMPANY STAYS ON THE TABLE. A b
- `get_code_example` — Emit a copy-pasteable HTTP snippet wired to the real endpoint, header and parameter names. ★ FOR WRITING YOUR OWN CLIENT, NOT FOR GETTING DATA. Every other tool
- `run_recipe` — Replay a saved multi-step routine over rows you fetched, with every step listed. ★ THREE ROUTINES: `momentum_scan` (rank by a return column), `earnings_surprise
- `try_sample` — Hand an unregistered caller a short taste of an open dataset, plus where to unlock the rest. ★ WHAT AN ACCOUNTLESS CALLER GETS INSTEAD OF A BARE REFUSAL. Somebo
- `run_backtest` — Run a point-in-time backtest and return its run_id, metrics, sources and honesty checks. The run may only see data stamped on or before `as_of` — that is enforc
- `get_backtest` — Retrieve a previous backtest by run_id — the full record, including why it was rejected. Only runs in YOUR namespace are visible; a run_id belonging to someone 
- `replay_backtest` — Re-run a stored backtest and report whether it still produces the same numbers. Same spec, same `as_of`, same data questions. If the numbers moved, either the e
- `list_backtests` — Browse an INDEX of your past backtest runs — ids and headline metrics only, no re-execution. Use when you want to find a run whose id you have forgotten. It nev
- `memory_save` — Remember something, with its sources and its knowledge time. Nothing is ever overwritten: saving a `factor_def` or `watchlist` under an existing key SUPERSEDES 
- `memory_search` — Recall your own memories — hybrid (semantic + exact-term), with provenance attached. Every result carries where it came from (`source_query_ids`, replayable), w
- `memory_get_watchlist` — Read the tickers on one named watchlist, as it stands right now. A curated roster you maintain — distinct from `memory_search`, which digs through everything yo
- `memory_replay_query` — Re-run a remembered query by its `twmd_q_…` id, through the read API's own replay store. This is what makes a recalled finding checkable: the memory says where 
- `run_research` — Run a multi-agent research pass and return a structured, sourced report. Six roles run in order — data analyst, factor researcher, backtest engineer, risk offic
- `get_research` — Retrieve one of YOUR previous research reports. Others' runs are simply not found. Args: research_id — the identifier `run_research` returned when it started th
- `list_pending_actions` — Financial actions proposed by your research runs that are waiting for a human decision. Nothing here has been executed or ever will be by this system. These are
- `approve_action` — Record a HUMAN's approval of a proposed action. This writes an audit record naming who approved what, and when. It does NOT execute the action: TWMD has no orde
- `list_alerts` — Show the price-trigger rules you have armed, and whether each is still armed. A read-only inventory of thresholds you asked to be watched — it arms nothing and 
- `set_price_alert` — Leave a standing instruction: tell me when this symbol crosses this price. The alert OUTLIVES this conversation. It is evaluated against official daily closes b
- `delete_alert` — Cancel one armed price trigger permanently, by its rule id. Disarms a single watch so it will not fire again — the opposite of `set_price_alert`, and unlike `li
- `risk_assess` — Measure a portfolio you state against limits you state, on official point-in-time prices. Reports concentration and peak-to-trough drawdown, and NAMES every pos
- `agent_activity` — What YOUR agents have actually done, from the durable audit trail. Every resident agent records what it did and ON WHAT BASIS — the rule and the two closes behi
- `list_factor_findings` — Verdicts from the overnight factor search on YOUR namespace — including the rejections. The rejections are returned deliberately. A research log that keeps only
- `company_health_check` — 一檔股票的誠實體檢:成長、獲利品質、估值、籌碼、紅旗,每個數字可驗證。 ★ 這是**事實整理**,不是投資建議、不是預測、不是目標價。輸出帶 `does_not_prove`,轉述時請一併保留。 ★ POINT-IN-TIME:`as_of` 逐資料集尊重揭露時差 —— 月營收用法定截止日推得的 估計時點,財報用出表日
- `positioning_read` — 籌碼結構:法人分項、融資融券、借券使用率、大戶集中度、董監質押。 ★ 事實整理,不是投資建議、不是預測、不是目標價。輸出帶 `does_not_prove`。 ★ POINT-IN-TIME:`as_of` 逐資料集尊重揭露時差;不給就用「現在可知的最新」。 ★ 看不到的在 `cannot_see`,並分「查了沒有 /
- `macro_regime_read` — 總經 Regime:景氣信號、利率與殖利率曲線、匯率、資金流。 ★ 這支講的是**整個市場**,不是任何一檔個股 —— 所以它不收 ticker。 ★ 事實整理,不是投資建議、不是預測。輸出帶 `does_not_prove`。 ★ ⚠️ `macro_worldbank` 類的來源會**回溯修訂**歷史年度:今天讀到
- `supply_chain_read` — 供應鏈與同業:產業鏈位置、同業分組、轉投資、外銷訂單 vs 營收。 ★ 事實整理,不是投資建議、不是預測。輸出帶 `does_not_prove`。 ★ ⚠️ `company_peer_groups` 無日期欄:指定過去的 `as_of` 時,回的是**現況**分組, `pit_notes` 會標「非當時分類」。 ★
- …and 1 more

## Install

**Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
**Cautions** (coverage gaps and advisories — never blocking)
- No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"tw-market-data\": {\n      \"type\": \"http\",\n      \"url\": \"https://mcp.twmarketdata.com/mcp\"\n    }\n  }\n}"
```

## Blast radius

Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on someone else's infrastructure.
- Floor 32, ceiling 56 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/com.twmarketdata%2Ftw-market-data
- Install plan: https://forgeregistry.com/api/v1/packages/com.twmarketdata%2Ftw-market-data/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/com.twmarketdata%2Ftw-market-data
- HTML page: https://forgeregistry.com/registry/com.twmarketdata%2Ftw-market-data
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.